Описание
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: add HE 6 GHz capability in the scan elems len
The HE 6 GHz Band Capability element is in the probe request for
every band if 6 GHz is supported, so add the size to scan_ies_len.
Otherwise, building probe request elements can fail, triggering the
WARN_ON in __ieee80211_start_scan().
A flaw was found in the Linux kernel's mac80211 wireless subsystem. This flaw allows a local user to cause a Denial of Service (DoS) by initiating a wireless scan on a device supporting 6 GHz High Efficiency (HE) bands. Because the kernel fails to account for the HE 6 GHz capability element when calculating the required scan element length, probe request generation fails and triggers a kernel warning.
Отчет
A low impact flaw was found in the Linux kernel mac80211 wireless subsystem. When a local user with the ability to request a wireless scan (for example via nl80211) triggers a scan on a device supporting 6 GHz High Efficiency (HE) bands, the kernel does not account for the HE 6 GHz Band Capability element when calculating the required scan element buffer length (scan_ies_len). Building the probe request elements can then fail and trigger the WARN_ON in __ieee80211_start_scan(), resulting in a local denial of service limited to the wireless scanning functionality. No memory corruption, information disclosure, or privilege escalation is involved; the size check safely aborts the operation. On systems configured with panic_on_warn, the kernel warning could additionally lead to a kernel panic. The kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10, the Red Hat In-Vehicle OS 2 kernels, and the OpenShift Container Platform RHEL CoreOS kernels are affected. Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present, and Red Hat Enterprise Linux 6 is out of support scope. Given the low security impact, the fix for the affected products is deferred to a future scheduled update; the residual risk is limited to failed wireless scans and a kernel warning on hardware supporting the 6 GHz band. The CVSS:3.1 base score of 5.5 (Moderate) reflects the highest theoretical availability impact, while the practical impact is low because the flaw only causes the scan operation to fail and trigger a warning rather than corrupting memory or crashing the kernel under the default configuration.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scan_ies_len. Otherwise, building probe request elements can fail, triggering the WARN_ON in __ieee80211_start_scan().
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scan_ies_len. Otherwise, building probe request elements can fail, triggering the WARN_ON in __ieee80211_start_scan().
wifi: mac80211: add HE 6 GHz capability in the scan elems len
In the Linux kernel, the following vulnerability has been resolved: w ...
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scan_ies_len. Otherwise, building probe request elements can fail, triggering the WARN_ON in __ieee80211_start_scan().
EPSS
5.5 Medium
CVSS3